Visual RFC.
ALL RFCs / RFC 2397
Read the RFC ↗
RFC 2397 / INLINE DATA URLS

Carry the content inside the URL

01

A data URL contains the data itself rather than naming a separate resource to retrieve.

RFC 2397 · § 2EXAMPLE
3 / 3
Carry the content inside the URLThree views. A conventional HTTPS reference names an external resource and a schematic request reaches its server. A separate data comma Hi URL carries its own bytes: scheme, omitted metadata and payload have distinct fields. Its Hi payload then supplies hexadecimal bytes48 and69 directly to the application, without a separate retrieval for this carried item. No network operation is performed; interpreting embedded content remains a separate policy decision.Carried content, no separate retrievaldata:,Hidecode carried bytes48 69US-ASCII: HiInterpretation still needs application policy
03
Hand carried bytes to the application.

The inline payload supplies bytes 48 69 in hexadecimal, which spell Hi in US-ASCII. This example needs no separate content retrieval; interpretation remains a different decision.

Source for this drawing: RFC 2397 · Read RFC section 2 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A request starts a conversation.

A client asks for a resource. A server sends a response. The method, address, headers, and status explain what that conversation means.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

The comma separates metadata from carried content.

  • The form is data:[media type][;base64],data. The first literal comma separates the description from the payload; later commas can be part of the data.
  • A URL is a Uniform Resource Locator. Here data is the scheme name, not an acronym. Inline means the small content is included in the URL itself.
  • There are no relative data URL forms. This scheme does not provide a host or a relative path to resolve; applications still decide how to use the carried content.
DETAILS

The diagrams compare a fictional HTTPS reference with data:,Hi. No request is made and no content is executed. A data URL supplies bytes directly, but this does not imply that interpreting arbitrary embedded content can never trigger further behavior. Field widths are schematic; [omitted] is an explanatory placeholder, not literal URL text.

Read the RFC section ↗

All chapters in RFC 2397

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗